Unauthenticated PHP Object Injection exists in WordPress Booktics plugin up to version 1.0.21. The vulnerability allows an attacker to inject serialized PHP objects, which the plugin deserializes without validation. This flaw can lead to arbitrary code execution, data tampering, or complete site compromise and is identified as CWE-502.

The issue affects installations of the WordPress Booktics plugin version 1.0.21 or earlier, developed by Arraytics. Any WordPress site that has not upgraded to version 1.0.22 or newer is vulnerable.

The CVSS score of 9.8 signals a severe risk, while an EPSS score of less than 1% indicates that exploitation attempts are currently rare. The vulnerability is not listed in CISA's KEV catalog, meaning no documented public exploits exist yet. The likely attack vector involves an unauthenticated HTTP request that carries malicious serialized data to a publicly exposed plugin endpoint, which then processes the data without proper authentication or validation.